diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix
index c65b0c0eabf2..5479debb66f7 100644
--- a/pkgs/development/libraries/ngtcp2/gnutls.nix
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.11.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = "ngtcp2";
     rev = "v${version}";
-    sha256 = "sha256-u6orYF/VzXpcUdCitPawoet3KAhXlTQ2giR5eTQkrLY=";
+    sha256 = "sha256-nUUbGNxr2pGiEoYbArHppNE29rki9SM/3MZWMS9HmqY=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/tools/go-task/default.nix b/pkgs/development/tools/go-task/default.nix
index c9d15f020125..af107674d063 100644
--- a/pkgs/development/tools/go-task/default.nix
+++ b/pkgs/development/tools/go-task/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-task";
-  version = "3.19.0";
+  version = "3.19.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "task";
     rev = "v${version}";
-    sha256 = "sha256-UsMUBdhoWl2e4i3m7Tu4R3qULRf85V4Uw/52xMMyWio=";
+    sha256 = "sha256-MtbgFx/+SVBcV6Yp1WEwKLQGx5oPxvqljtXeyUYNS+I=";
   };
 
-  vendorSha256 = "sha256-+DmnYd415FWgbY+gkDVWjnvbjTppfFV5NMpIE3Mm124=";
+  vendorHash = "sha256-AZtkWJ/U1dH9J+wowlcg25qBVyRRo6LCzc6IBYKBkVA=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/repository-managers/nexus/default.nix b/pkgs/development/tools/repository-managers/nexus/default.nix
index 6a92bd2fba28..d69773636650 100644
--- a/pkgs/development/tools/repository-managers/nexus/default.nix
+++ b/pkgs/development/tools/repository-managers/nexus/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nexus";
-  version = "3.37.3-02";
+  version = "3.45.0-01";
 
   src = fetchurl {
     url = "https://sonatype-download.global.ssl.fastly.net/nexus/3/nexus-${version}-unix.tar.gz";
-    sha256 = "sha256-wdtDGQjFp2tEAVxVXW70UXq/CoaET6/+4PXWxiNZMS0=";
+    hash = "sha256-ISTORslFPgFt0kEKK17fpBXi3yAMwgm6qDnk33V2wa0=";
   };
 
   preferLocalBuild = true;
diff --git a/pkgs/development/tools/rust/cargo-flamegraph/default.nix b/pkgs/development/tools/rust/cargo-flamegraph/default.nix
index adeee5c9c53d..1932590162b8 100644
--- a/pkgs/development/tools/rust/cargo-flamegraph/default.nix
+++ b/pkgs/development/tools/rust/cargo-flamegraph/default.nix
@@ -4,16 +4,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-flamegraph";
-  version = "0.5.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "flamegraph-rs";
     repo = "flamegraph";
     rev = "v${version}";
-    sha256 = "sha256-Q930PIGncUX2Wz3hA1OQu0TEPMfOu2jMpBPbaAVlUMU=";
+    sha256 = "sha256-LYoyMEALxeUQQI2pBL1u0Q9rrwyy6N6Dg5bNxhJiVrM=";
   };
 
-  cargoSha256 = "sha256-ENL1FeIn9HESyp1VhePr4q7BLCc0SS8NAuHKv1crJE8=";
+  cargoSha256 = "sha256-t8+bjTRQMuXTYhgW1NuC3MXsRh2SMeycyyq4x1nb9MU=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/tools/rust/cargo-geiger/default.nix b/pkgs/development/tools/rust/cargo-geiger/default.nix
index a0e458bbd6e8..03fbd4dd31e2 100644
--- a/pkgs/development/tools/rust/cargo-geiger/default.nix
+++ b/pkgs/development/tools/rust/cargo-geiger/default.nix
@@ -13,15 +13,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-geiger";
-  version = "0.11.4";
+  version = "0.11.5";
 
   src = fetchFromGitHub {
     owner = "rust-secure-code";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-GxlUhfzGIKHSTNcSme/mQums6yI4ev8V0L1bXAWt8pw=";
+    sha256 = "sha256-PrrhxY+Hk1XfdV0u4GgIsbo8oNOFnqbCeivY2Ix6g+k=";
   };
-  cargoSha256 = "sha256-nCMUnhxNAMdk3Mi6eebrViQ1G5jcc3jk+CPRTUvcWRc=";
+  cargoHash = "sha256-D3upXhKFkuZfEVOPJ9mCwoZkbkX9s2MltyTkKcBvb6I=";
 
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security libiconv curl ];
diff --git a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
index 7089a574748d..a42621ad5047 100644
--- a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
@@ -6,13 +6,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-cov";
-  version = "0.5.5";
+  version = "0.5.7";
 
   src = fetchzip {
     url = "https://crates.io/api/v1/crates/${pname}/${version}/download#${pname}-${version}.tar.gz";
-    sha256 = "sha256-L+byatz2Pq30+Gw0lq1/7Q1FJXi6z+J/nhySFBAfoMo=";
+    sha256 = "sha256-yw3Fv1KmItamja8YLiEQ5kcidjL80hEvxWVIaqA3DP0=";
   };
-  cargoSha256 = "sha256-/8kza5fW23UYlebchYtgo2GU8M7LXNXSKV2dQ6xZllw=";
+  cargoSha256 = "sha256-uYeF26MoQudukuzaKgLFQifRCoCairFbQYgznLq5Nm8=";
 
   # skip tests which require llvm-tools-preview
   checkFlags = [
diff --git a/pkgs/os-specific/linux/firmware/ath9k/default.nix b/pkgs/os-specific/linux/firmware/ath9k/default.nix
index 63c49c0a0887..42aca54e9332 100644
--- a/pkgs/os-specific/linux/firmware/ath9k/default.nix
+++ b/pkgs/os-specific/linux/firmware/ath9k/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     let
       inherit (lib) toUpper splitString last listToAttrs pipe;
       inherit (builtins) map;
-      urls-and-hashes = import ./urls-and-hashes-${finalAttrs.version}.nix;
+      urls-and-hashes = import (./. + "/urls-and-hashes-${finalAttrs.version}.nix");
       make-links = pipe
         [ "gcc" "binutils" "gmp" "mpfr" "mpc" ]
         [ (map (vname: fetchurl rec {
diff --git a/pkgs/servers/home-automation/evcc/default.nix b/pkgs/servers/home-automation/evcc/default.nix
index 715ab8dd349c..5870e1c3029a 100644
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@@ -16,20 +16,20 @@
 
 buildGoModule rec {
   pname = "evcc";
-  version = "0.110.1";
+  version = "0.111.0";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = pname;
     rev = version;
-    hash = "sha256-SIBVvVl1O+vqQug6LTzKEzFAay82ot4e+rXd17Djvqc=";
+    hash = "sha256-amXB4iLZJXJuU4gaTSpDc+kNoTVx08EUis0ld0XtcMs=";
   };
 
-  vendorHash = "sha256-YP6/3+jVbavBE6ZSopryC1SgQc5kzE+gWpNbwptBMG8=";
+  vendorHash = "sha256-+qne/eB+z8e0vStC9V0w7jgWgo3vvkaR42dUe+/eXDE=";
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-hc3IkWiafKBGtGPEPWWbj4XQsGh+PrGGnBV2bzEAn0s=";
+    hash = "sha256-zrNfev2x5quuujifRHUufBK/GnR7QkCypHCyYb4nwkI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/spicedb/zed.nix b/pkgs/servers/spicedb/zed.nix
index 39ac2ddc6d60..efb672da5f1f 100644
--- a/pkgs/servers/spicedb/zed.nix
+++ b/pkgs/servers/spicedb/zed.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "zed";
-  version = "0.4.4";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "zed";
     rev = "v${version}";
-    hash = "sha256-tw8Z8JtmmRLcvFacRDAdIi6TyMtm9FAZvRYNgd49qXg=";
+    hash = "sha256-Q12zM9GgQQBykFLZ3nwdkl8Nk/0nbXaOJzXzO8wSOXY=";
   };
 
-  vendorHash = "sha256-/BxQiaBFkJsySnQRU870CzvPxtPwvdwx4DwSzhaYYYQ=";
+  vendorHash = "sha256-AEU8yTG+n+JOSB7Cnmf+mztm/1c5vuarSqVr3hC/14g=";
 
   meta = with lib; {
     description = "Command line for managing SpiceDB";
diff --git a/pkgs/tools/compression/bzip3/default.nix b/pkgs/tools/compression/bzip3/default.nix
index c34414fa706c..55ef5309d57d 100644
--- a/pkgs/tools/compression/bzip3/default.nix
+++ b/pkgs/tools/compression/bzip3/default.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bzip3";
-  version = "1.2.1";
+  version = "1.2.2";
 
   outputs = [ "bin" "dev" "out" ];
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     owner = "kspalaiologos";
     repo = "bzip3";
     rev = version;
-    hash = "sha256-RzlDubT+nczIlUcwnZ5PsO5s3Op7WLRuiMBRBasuEFI=";
+    hash = "sha256-B59Z7+5SFjt/UgppNtdUtzw96y+EVglHoKzq9Il9ud8=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/nurl/default.nix b/pkgs/tools/misc/nurl/default.nix
index b716e279404e..60b27d17823d 100644
--- a/pkgs/tools/misc/nurl/default.nix
+++ b/pkgs/tools/misc/nurl/default.nix
@@ -3,6 +3,8 @@
 , fetchFromGitHub
 , installShellFiles
 , makeWrapper
+, stdenv
+, darwin
 , gitMinimal
 , mercurial
 , nix
@@ -10,22 +12,26 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nurl";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nurl";
     rev = "v${version}";
-    hash = "sha256-bZJlhGbRjhrLk8J0WJq3NCY71MZYsxy8f1ippguOsIM=";
+    hash = "sha256-cPbvYrMeARNi9b97EPUUzYN5j0YjenOCDdrdRVLBviw=";
   };
 
-  cargoSha256 = "sha256-904IOaovvSOuMyXIxZjaG2iqUoz5qq3hftLGaiA8h0U=";
+  cargoSha256 = "sha256-CBZe3UdTucgWrCzbXCSWjBjCNWCFUHmCpRwCXUX2sA8=";
 
   nativeBuildInputs = [
     installShellFiles
     makeWrapper
   ];
 
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
   # tests require internet access
   doCheck = false;